Question

Contoso runs a hub-and-spoke topology in Azure. The hub VNet contains a VPN gateway that provides connectivity to the on-premises datacenter. Two spoke VNets are peered to the hub. Currently, VMs in the spoke VNets cannot reach on-premises resources, although they can reach VMs in the hub. You must enable the spokes to use the hub's VPN gateway to communicate with on-premises, while minimizing cost and administrative effort. What should you configure on the peerings?

Accepted Answer

On the hub-to-spoke peerings enable 'Use this virtual network's gateway or Route Server', and on the spoke-to-hub peerings enable 'Use the remote virtual network's gateway or Route Server'.

Answer

Deploy a separate VPN gateway in each spoke VNet and create site-to-site connections from each spoke to on-premises.

Answer

On the spoke-to-hub peerings enable 'Use this virtual network's gateway or Route Server', and on the hub-to-spoke peerings enable 'Use the remote virtual network's gateway or Route Server'.

Answer

Create user-defined routes in each spoke that point 0.0.0.0/0 to the hub VPN gateway's private IP address as the next hop.